Access to Information Implementation Notice 2023-01: Amendments to Access to Information Regulations

5.2.1 Right of access

A government institution must receive some evidence to be reasonably satisfied of the requester’s right of access. In the vast majority of cases, the information received by the institution via the ATI request form or otherwise will suffice to establish a right of access. Adequate indicators contained in the request may consist of:

• the requester’s attestation of eligibility, as indicated in an online submission
• the requester’s contact information, including name, address and telephone number
• postmark, if the request was submitted by mail
• the institution’s prior knowledge of the requester’s identity; this includes when the person indicates an assigned file or case number or another verifiable unique identifier, and when the requester refers to a previous access to information request to which they were the originator, or
• the requester’s identity document should the person choose to submit such a document along with their request

Subsection 4(2) of the amended ATIR provides the authority for institutions to conduct verifications and request additional information from the person making the request, when the information contained in the request or other confirmation methods are insufficient to establish that the requester has a right of access under section 4 of the ATIA. This should not result in unnecessary barriers or undue delay to the right of access. Requesting additional information should be done as a last resort in situations where there is doubt regarding the requester’s right of access, for example, doubt of actual presence in Canada, residency or citizenship. This can occur, for example, when an institution receives inconsistent or contradictory information from a requester as it relates to the right of access.

In case of doubt regarding the accuracy of the information initially received when seeking to confirm the right of access (for requests not submitted online), the Appendix provides a model attestation letter that could be used by institutions that do not already have similar or other such practices in place. If used, the letter can be adapted to suit the institution’s specific needs.

In certain cases, institutions may determine that further information is required to confirm the right of access and would potentially be collecting additional personal information in accordance with the Standard Personal Information Bank for Access to Information and Privacy Act Requests (PSU 901). Procedures must be in place to properly collect and manage this information in accordance with the Privacy Act, Privacy Regulations and privacy policies.

During the verification process, when informing the requester that further information is required to verify their right of access, it is a best practice to advise them that their request will be put on temporary hold until their right of access can be confirmed.

If the requester does not provide the requested information within a reasonable timeline indicated by the institution, the request may be considered abandoned, and the file may be closed. Before closing the file, institutions are encouraged to send a final notice to the requester. Requesters must also be informed of their right to complain to the Office of the Information Commissioner of Canada with respect to the processing of their request.

5.2.2 Requesting personal information

While the Privacy Regulations specify that a requester must provide identification before access to personal information is granted, there was no similar regulatory requirement under the ATIR, even though personal information is often requested under the ATIA regime.

To clarify well-established current procedures and ensure that the requester’s privacy is equally protected under the ATI regime as under the privacy regime, the amended regulations provide the regulatory authority for institutions to seek adequate identification from requesters, when the requested records via the ATIA regime contain their personal information and their identity has not been otherwise confirmed (section 5 of the ATIR). If it is determined that additional information is required for identity verification purposes, Privacy Implementation Notice 2022-02: Identity Verification for Personal Information Requests must be followed, with the necessary adaptations.

This approach ensures compliance with section 19 of the ATIA, which generally prohibits the disclosure of personal information in the context of an ATI request, unless one of the conditions in subsection 19(2) is met. A risk-based approach should be taken when determining whether the personal information already provided is adequate to validate identification. Where the sensitivity of the requested information is relatively low and the identity is reasonably assured as per the Directive on Identity Management, institutions should facilitate the right of access. However, as the sensitivity of the information and the potential injury to the individual increases, the standard for adequate identity verification rises and preventing breaches should be prioritized. There may also be scenarios where there are reasons to doubt the identity of the requester, for example, if conflicting information is provided compared to what is on file. The Treasury Board of Canada Secretariat’s Assurance Level Requirement tool can assist in assessing the sensitivity of the information, and the Directive on Identity Management - Appendix A: Standard on Identity and Credential Assurance provides guidance on the identity requirements.

During the process of verifying the requester’s identity, it is a best practice to advise the requester that personal information will not be disclosed under the ATIA until their identity can be confirmed. At this point, if the request pertains uniquely to records containing personal information, or the personal information cannot be reasonably severed from the requested records, or responding to the request without confirming identity would in and of itself reveal the personal information, the request may be put on hold. If the requester fails to provide adequate identification within a reasonable timeline indicated by the institution, the request may be considered abandoned, and the file may be closed.

Before closing the file, institutions are encouraged to send a final notice to the requester. Requesters must also be informed of their right to complain to the Office of the Information Commissioner of Canada with respect to the processing of their request.

If, however, the personal information can be reasonably severed from other non-personal information to which the requester has a right of access, then the institution must process the request and sever the personal information from the records to be disclosed, as appropriate.